CVE-2017-6928 Drupal access bypass vulnerability
An access bypass vulnerability in Drupal core allows unauthorized users to view or download private files under specific module conflict conditions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-6928?
CVE-2017-6928 is a medium-severity missing authorization vulnerability in Debian Debian Linux, published on 1 Mar 2018. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Drupal core 7.x versions before 7.57 when using Drupal's private file system, Drupal will check to make sure a user has access to a file before allowing the user to view or download it. This check fails under certain conditions in which one module is trying to grant access to the file and another is trying to deny it, leading to an access bypass vulnerability. This vulnerability is mitigated by the fact that it only occurs for unusual site configurations.
Weakness: CWE-732
Which versions are affected by CVE-2017-6928?
4 open source packages ship an affected version, including drupal/core and drupal/drupal. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
drupal/core Packagist | From 7.0 | 7.57 |
drupal/core Packagist | From 7.0 | 7.57 |
drupal/drupal Packagist | From 7.0 | 7.57 |
drupal/drupal Packagist | From 7.0 | 7.57 |
Products include Debian Debian Linux, Drupal Drupal.
How do I fix CVE-2017-6928?
Upgrade drupal/core to 7.57 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2017-6928 being exploited?
There is no known exploitation of CVE-2017-6928 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as GHSA-66mv-q8r2-hj8w, UBUNTU-CVE-2017-6928.